Privacy Act 2026
Can You Be Sued for Invading Someone's Privacy in Australia? The New Statutory Tort, Explained
Australia's statutory tort for serious invasions of privacy has been in force since 10 June 2025. Who can sue, the two pathways (intrusion upon seclusion and misuse of information), remedies, the damages cap, and why turnover doesn't protect you. Source-checked.
Here is a question more Australian businesses should be asking in 2026: can someone sue us directly for invading their privacy? Since 10 June 2025, the answer is yes — there is a new statutory tort for serious invasions of privacy, and it does not care how big you are. This explains how it works, in plain English.
(About Australia's privacy law, not the US Privacy Act of 1974.)
What the tort is
The statutory tort lets individuals (not corporations) sue for a serious invasion of privacy that was intentional or reckless — importantly, not merely negligent. There are two pathways:
- Intrusion upon seclusion — for example, watching, listening to or recording
someone's private activities; and
- Misuse of information — for example, collecting, using or disclosing information
about someone improperly.
To succeed, the person must have had a reasonable expectation of privacy, and the public interest in protecting their privacy must outweigh any countervailing public interest (such as freedom of expression). (Source: OAIC.)
Why this matters even if the Privacy Act doesn't apply to you
This is the part businesses miss: the tort is broader than the Privacy Act. It can reach businesses that are not APP entities — so a sub-$3M small business is not automatically safe. And it is run by the courts, not the OAIC. Turnover is irrelevant.
Remedies — and the damages cap
A court can award damages, grant an injunction, or order an apology, as it considers appropriate (the list is not exhaustive; an account of profits is also possible). On damages:
- Proven economic loss is NOT capped.
- Non-economic-loss damages (plus any exemplary/punitive damages in exceptional
cases) are capped at $478,550 or the defamation non-economic-loss maximum, whichever is greater (indexed).
(Source on remedies: OAIC; on the cap: reputable legal commentary such as MinterEllison.)
Where claims can be brought
Claims can be commenced in the Federal Court, the Federal Circuit and Family Court (Division 2), and State and Territory courts.
What businesses should do
- Tighten collection, storage and surveillance practices — especially anything
that records or monitors people.
- Be careful with disclosure of personal information.
- Treat this alongside your other privacy obligations — see the
- Note the workplace angle: employers face specific exposure — see
the privacy tort and your workplace.
Run the free checker to map your broader privacy obligations.
General information only, not legal or compliance advice. Current to June 2026; the damages cap is indexed. Confirm your position at oaic.gov.au or with a qualified adviser. Last verified: 8 June 2026.
Run the free ML/TF risk assessment →